There is another issue not mentioned in the original report and that is that aliases.db must be owned by the Mailman user so Postfix runs the pipe as the Mailman user and group.
bin/check_perms would check/fix this and also ensure the mode is at least 0660, but I've gone a step further and now ensure these things at the time the postalias and postmap commands are run and also ensure the mode is at least 0664 so Postfix doesn't need to be in Mailman's group.
** Changed in: mailman Importance: Undecided => Medium
** Changed in: mailman Status: New => Fix Committed
** Changed in: mailman Milestone: None => 2.1.25
** Changed in: mailman Assignee: (unassigned) => Mark Sapiro (msapiro)